Integrity

Clarifications:

• This criterion is intended to support the HIPAA Security Rule implementation specification provided at 45 CFR 164.312 (e)(2)(i) “[i]implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.” Because this certification criterion specifies a capability that certified health IT must include, ONC does not believe that it is necessary or appropriate to address whether hashing is applicable to public and private networks. [see also 75 FR 44620]
• Certification only ensures that a Health IT Module can create hashes using SHA-2, and it does not require the use of SHA-2. For example, users of certified health IT may find it appropriate to continue to use SHA-1 for backwards compatibility if their security risk analysis justifies the risk. [see also 80 FR 62657]

Technical outcome – The Health IT Module can create a message digest using a hashing algorithm with security strength equal or greater than SHA-2.

Clarifications:

• A Health IT Module must demonstrate integrity protection controls for data received during an exchange (e.g., by generating a hash upon receipt of a summary record in order to ensure the integrity of the information exchanged).

Technical outcome – The Health IT Module must be able to verify, in accordance with a hashing algorithm with security strength equal or greater than SHA-2, that information has not been altered or changed in any way.

Clarifications:

• A Health IT Module does not need to differentiate between internal and external transmissions as the capability’s subsequent use (post-certification) is at the discretion of the implementation setting’s policies. [77 FR 54251]